This vulnerability affects Oracle Commerce Guided Search / Oracle Commerce Experience Manager (Content Acquisition System component) version 11.4.0. It is easily exploitable by an unauthenticated attacker over the network via HTTP. The impact includes unauthorized modification of critical data and the ability to cause a complete denial of service by hanging or crashing the system. The CVSS 3.1 base score is 9.1, reflecting high integrity and availability impacts. The vulnerability is tracked as CWE-306 (Missing Authentication for Critical Function).

An attacker can gain unauthorized ability to create, delete, or modify critical data or any data accessible by Oracle Commerce Guided Search / Oracle Commerce Experience Manager. Additionally, the attacker can cause the system to hang or crash repeatedly, resulting in a complete denial of service. There is no confidentiality impact reported.

Oracle has released a Critical Security Patch Update in August 2026 that addresses this and many other vulnerabilities. Customers are strongly advised to apply the relevant patches promptly. The vendor advisory does not indicate that this vulnerability is already mitigated or requires no action. Since this is not a cloud service, remediation depends on applying the patch to affected installations. Check the Oracle advisory at https://www.oracle.com/security-alerts/cspuaug2026.html for patch availability and installation instructions.